@@ -8,16 +8,19 @@ module Filtering
88 #
99 # @param requested_field [String] the field to parse
1010 # @return [Array] with the fields and the predicate
11- def self . extract_attributes_and_predicates ( requested_field )
11+ def self . extract_attributes_and_predicates ( requested_field , allowed_fields )
1212 predicates = [ ]
1313 field_name = requested_field . to_s . dup
1414
1515 while Ransack ::Predicate . detect_from_string ( field_name ) . present? do
16+ # break if we have an exect match with an allowed_fields
17+ # we do not want to pick apart the string further
18+ break if allowed_fields . include? ( field_name )
19+
1620 predicate = Ransack ::Predicate
1721 . detect_and_strip_from_string! ( field_name )
1822 predicates << Ransack ::Predicate . named ( predicate )
1923 end
20-
2124 [ field_name . split ( /_and_|_or_/ ) , predicates . reverse ]
2225 end
2326
@@ -54,7 +57,7 @@ def jsonapi_filter_params(allowed_fields)
5457
5558 requested . each_pair do |requested_field , to_filter |
5659 field_names , predicates = JSONAPI ::Filtering
57- . extract_attributes_and_predicates ( requested_field )
60+ . extract_attributes_and_predicates ( requested_field , allowed_fields )
5861
5962 wants_array = predicates . any? && predicates . map ( &:wants_array ) . any?
6063
@@ -88,7 +91,7 @@ def jsonapi_sort_params(allowed_fields, options = {})
8891 end
8992
9093 field_names , predicates = JSONAPI ::Filtering
91- . extract_attributes_and_predicates ( requested_field )
94+ . extract_attributes_and_predicates ( requested_field , allowed_fields )
9295
9396 next unless ( field_names - allowed_fields ) . empty?
9497 next if !options [ :sort_with_expressions ] && predicates . any?
0 commit comments